leviticustradeglobal[.]net

leviticustradeglobal.net was registered on 17 September 2025 through Unstoppable Domains Inc. The domain resolves to the Cloudflare‑hosted address 104.21.76.211 and uses the authoritative nameservers haley.ns.cloudflare.com and kayden.ns.cloudflare.com. It is currently listed on the PhishDestroy blocklist and appears on one additional security blocklist, indicating that at least one security vendor has flagged the host. VirusTotal reports 11 of 91 scanning engines flagging the domain as malicious, reflecting a moderate detection rate that aligns with its classification as a high‑risk phishing operation.

No public page title or brand attribution has been released, and the content of the site has not been captured in open‑source feeds, leaving the exact victim‑targeting vector uncertain. Infrastructure analysis shows the IP belongs to a Cloudflare edge node, which is commonly abused for fast‑flux and proxying malicious traffic, complicating takedown efforts. Defenders should immediately add 104.21.76.211 and leviticustradeglobal.net to DNS‑based blocklists and firewall deny lists, monitor for outbound connections to the IP, and consider sinkholing the domain at the DNS level.

Continuous re‑evaluation is advised, as the hosting provider may switch IPs without notice. Organizations receiving phishing reports referencing this domain should treat any associated email or credential request as malicious and instruct users to delete the communication. Ongoing threat‑intel feeds should be consulted for any emergence of page‑level indicators or associated payloads.